Executive brief
The Linux kernel's BPF subsystem contains a vulnerability in the bpf_cpumask_populate() function that allows the verifier to accept borrowed (read-only) CPU mask pointers from certain kernel functions as writable destinations. This type confusion could allow a malicious BPF program to write to memory it should not have write access to, potentially leading to privilege escalation or data corruption on systems running affected kernel versions.
Technical details
The vulnerability is a type confusion issue in the BPF cpumask kfunc bpf_cpumask_populate(). The function signature originally accepted struct cpumask * as the destination parameter, but the verifier did not enforce ownership rules properly. This allowed borrowed cpumask pointers (returned by read-only kfuncs like scx_bpf_get_online_cpumask()) to be accepted as writable destinations. The fix changes the destination parameter type to struct bpf_cpumask *, enforcing the same ownership rules as other mutating cpumask kfuncs. The vulnerability requires the attacker to load and run a malicious BPF program, which typically requires CAP_BPF or CAP_SYS_ADMIN capabilities. The patch was committed upstream in July 2026 and backported to stable kernel branches.
Affected products
- Linux Linux kernel Before 2026-07-12
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-07-12: patched: Fix committed upstream (commit 8740156ad33be5071b588b594c55f279457f667c)
- 2026-09-14: patched: Backported to stable kernel branches